huaweicloud Huawei Cloud APIG
STOP - Do not answer from general knowledge. Follow the procedure below.
Deployment Routing Guard
If this skill was reached via a DEPLOYMENT intent (the gateway instance is part of an application deployment, not a standalone ad-hoc operation), this is a cloud resource purchase: load huawei-iac first for orchestration (mandatory cost+balance gate, batch approval, session state, ordered destroy), then return here for the exact instance/API commands. Sandbox-deployed workloads (huawei-sandbox) bypass iac - no purchase involved.
Overview
Domain expertise for Huawei Cloud API Gateway (APIG). Covers instance lifecycle, API group/API creation, publishing, and FunctionGraph trigger integration.
Always discover parameters with hcloud APIG <Operation> --help before executing.
Critical Warnings
| Trap | Why |
|---|---|
| API group region-locked | Cannot move across regions |
| Throttling per-API default | Use app-level quotas for per-user limits |
| CORS must be explicit | OPTIONS preflight fails until configured |
BASIC spec has no public IP |
Use PROFESSIONAL + elb provider for public access |
| Instance creation takes 5-15min | Long-running async operation. State is Running (NOT "SUCCESS"). Poll with ListInstancesV2, wait for status == "Running" |
sl_domain is from API Group |
NOT from Instance. Get it from CreateApiGroupV2 or ListApiGroupsV2 response |
| API name must NOT have hyphens | [a-zA-Z0-9_]+ only. Hyphens cause regex validation failure |
| VPC params need prefix | --vpc.name=<n> / --subnet.vpc_id=<id> / --security_group.name=<n> with KooCLI 7.x |
Instance Management
Check Existing Instances
hcloud APIG ListInstancesV2 --cli-region=<r>
Create Instance
hcloud APIG CreateInstanceV2 --help
Key gotchas when creating:
| Param | Note |
|---|---|
--spec_id |
BASIC (no public access), PROFESSIONAL (requires --loadbalancer_provider) |
--loadbalancer_provider |
elb for public access (supports AddIngressEipV2), lvs for internal only (supports AddEipV2) |
--enterprise_project_id |
Required for enterprise accounts. Use "0" for default project |
--available_zone_ids |
Use AZ code like ap-southeast-3a, NOT UUID from ListAvailableZonesV2 |
--vpc_id, --subnet_id |
Must exist in the target region |
--security_group_id |
Required. Create a security group first via VPC CreateSecurityGroup (VPC v3 API — no vpc_id param needed) |
Add Public Access (ELB Provider Only)
BASIC instances have no public IP. Use PROFESSIONAL + elb provider for public access (lvs is internal-only).
hcloud APIG AddIngressEipV2 \
--instance_id=<id> \
--bandwidth_charging_mode=bandwidth \
--bandwidth_size=<size>
To use an existing EIP instead of creating a new one:
hcloud APIG AddIngressEipV2 \
--instance_id=<id> \
--eip_id=<existing-eip-id>
AddIngressEipV2only works withelbprovider.AddEipV2(without "Ingress") requireslvsprovider. Bandwidth minimum is 5 Mbps.
Verification — After binding, poll the instance to confirm EIP is active:
hcloud APIG ListInstancesV2 --cli-region=<region> --instance_id=<id> --cli-output=json | jq '.instances[0].eip_address'
Wait for eip_address to show a valid IP (may take up to 2 minutes). If eip_address is still null after 2 minutes, the EIP may not have been assigned.
Trap:
sl_domainfromCreateApiGroupV2is an internal-only domain (e.g.,*.apic.cn-north-4.huaweicloudapis.com). It may resolve to internal IP only (NXDOMAIN from public internet). For public access, always use theeip_addressfrom the instance, not thesl_domainor triggerinvoke_url.
API Group
hcloud APIG CreateApiGroupV2 --instance_id=<id> --name=<n>
| Param | Note |
|---|---|
--name |
Group name (required) |
--remark |
Description (optional) |
API Management
hcloud APIG CreateApiV2 --help
Publishing
hcloud APIG BatchPublishOrOfflineApiV2 \
--instance_id=<id> \
--action=online \
--env_id=<env-id> \
--apis.1=<api-id>
The operation is
BatchPublishOrOfflineApiV2, NOTPublishApiV2. The parameter isapis.1(1-based array), NOTapi_ids. For multiple APIs, use--apis.1,--apis.2, etc.
Throttling
hcloud APIG CreateRequestThrottlingPolicyV2 --instance_id=<id> --name=<n> --api_call_limits=1000
Common Workflows
| Task | Operation |
|---|---|
| List instances | ListInstancesV2 |
| Create instance | CreateInstanceV2 |
| Delete instance | DeleteInstancesV2 |
| Add public EIP | AddIngressEipV2 |
| Create API group | CreateApiGroupV2 |
| Create API | CreateApiV2 |
| Update API | UpdateApiV2 — change auth mode, path, etc. |
| List APIs | ListApisV2 |
| Publish | BatchPublishOrOfflineApiV2 |
| List APIs | ListApisV2 |
FunctionGraph Integration
To expose a FunctionGraph function via HTTP, you need the complete chain:
APIG Instance → API Group → DEDICATEDGATEWAY Trigger → Publish
After the trigger is created on FunctionGraph side, publish the API in APIG:
hcloud APIG BatchPublishOrOfflineApiV2 \
--instance_id=<apig-instance-id> \
--action=online \
--env_id=<env-id> \
--apis.1=<api-id-from-trigger>
See huawei-functiongraph skill → references/deploy-workflow.md for the full end-to-end workflow.
Cross-Skill References
- VPC setup: See
huawei-vpcfor VPC, subnet, security group creation - EIP setup: See
huawei-vpcfor EIP creation and binding - FunctionGraph: See
huawei-functiongraphfor DEDICATEDGATEWAY trigger creation
References
- APIG Docs: https://support.huaweicloud.com/apig/